Add CI that builds and runs every example #9
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: SE050 | |
| on: | |
| push: | |
| paths: | |
| - 'SE050/**' | |
| - '.github/workflows/se050.yml' | |
| pull_request: | |
| types: [opened, synchronize, reopened, ready_for_review] | |
| # No cron: nightly.yml calls this, so the nightly stays one run and one triage writer | |
| workflow_call: | |
| inputs: | |
| caller_run_id: | |
| description: 'run id of the calling workflow; keeps a called run in its own concurrency group' | |
| type: string | |
| default: '' | |
| workflow_dispatch: | |
| # github.workflow is the CALLER's name in a called workflow, so hardcode ours | |
| concurrency: | |
| group: ${{ inputs.caller_run_id && format('se050-call-{0}', inputs.caller_run_id) || format('se050-{0}', github.ref) }} | |
| cancel-in-progress: ${{ !inputs.caller_run_id }} | |
| permissions: | |
| contents: read | |
| env: | |
| # Pinned, per the manifest header: only wolfSSL follows a moving ref. | |
| SIMULATORS_REF: main | |
| PLUG_AND_TRUST_TAG: v04.07.01 | |
| NXP_SE050_DRIVER_REF: sim-compat | |
| jobs: | |
| resolve: | |
| uses: ./.github/workflows/_resolve-wolfssl.yml | |
| with: | |
| stable_count: 1 | |
| se050: | |
| needs: resolve | |
| name: Run / se050 (wolfcrypt_test) wolfSSL ${{ matrix.wolfssl_ref }} | |
| runs-on: ubuntu-24.04 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| wolfssl_ref: ${{ fromJson(needs.resolve.outputs.refs_json) }} | |
| timeout-minutes: 60 | |
| steps: | |
| - uses: actions/checkout@v5 | |
| - name: Install build deps | |
| run: | | |
| set -euo pipefail | |
| sudo apt-get update -qq | |
| sudo apt-get install -y --no-install-recommends \ | |
| build-essential cmake git autoconf automake libtool \ | |
| python3 pkg-config curl patch >/dev/null | |
| # SE050Sim implements the SE050's I2C/T=1/APDU stack with a TCP transport, | |
| # so no chip is needed. It also carries the PAL shims the SDK needs. | |
| - name: Build the SE050 simulator | |
| run: | | |
| set -euo pipefail | |
| git clone -q --depth 1 --branch "$SIMULATORS_REF" \ | |
| https://github.com/wolfSSL/simulators /tmp/simulators | |
| # se050-sim's Cargo.toml has se050 = { path = "../nxp-se050/se050" }, | |
| # so the driver has to sit beside it, not anywhere convenient. | |
| git clone -q --depth 1 --branch "$NXP_SE050_DRIVER_REF" \ | |
| https://github.com/LinuxJedi/nxp-se050.git /tmp/simulators/SE050Sim/nxp-se050 | |
| cd /tmp/simulators/SE050Sim/se050-sim | |
| cargo build --release --bin tcp_server | |
| cp target/release/tcp_server /tmp/se050-sim-server | |
| test -x /tmp/se050-sim-server | |
| # Public: no licence and no hardware, contrary to the old skip reason. | |
| - name: Clone the Plug&Trust SDK and apply wolfSSL's OSP patch | |
| run: | | |
| set -euo pipefail | |
| git clone -q --depth 1 --branch "$PLUG_AND_TRUST_TAG" \ | |
| https://github.com/NXP/plug-and-trust.git /tmp/simw-top | |
| curl -fsSL \ | |
| https://raw.githubusercontent.com/wolfSSL/osp/master/nxp-se05x-middleware/simw-top-v040701.patch \ | |
| -o /tmp/simw.patch | |
| cd /tmp/simw-top | |
| patch -p1 -l --forward --fuzz=3 < /tmp/simw.patch | |
| test -f sss/src/wolfssl/fsl_sss_wolfssl_apis.c | |
| S=/tmp/simulators/SE050Sim/wolfcrypt-test | |
| # point the SDK's I2C at the simulator's TCP socket, and stub the GPIO reset | |
| cp "$S/i2c_a7.c" hostlib/hostLib/platform/linux/i2c_a7.c | |
| cp "$S/se05x_reset.c" hostlib/hostLib/platform/rsp/se05x_reset.c | |
| cp "$S/CMakeLists.txt" CMakeLists.txt | |
| python3 "$S/patch_ftr.py" fsl_sss_ftr.h | |
| grep -q 'SSS_HAVE_EC_NIST_224' fsl_sss_ftr.h | |
| # Three-pass bootstrap: wolfSSL and the SDK each link against the other. | |
| - name: Pass A, wolfSSL without SE050 for the SDK to link | |
| run: | | |
| set -euo pipefail | |
| git clone -q --depth 1 --branch '${{ matrix.wolfssl_ref }}' \ | |
| https://github.com/wolfSSL/wolfssl /tmp/wolfssl | |
| cd /tmp/wolfssl | |
| ./autogen.sh >/dev/null | |
| ./configure --enable-keygen --enable-cmac \ | |
| CFLAGS="-DWOLFSSL_SE050_NO_TRNG -DSIZEOF_LONG_LONG=8" >/dev/null | |
| make -j"$(nproc)" >/dev/null | |
| sudo make install >/dev/null | |
| sudo ldconfig | |
| - name: Build the SDK with HostCrypto=WOLFSSL | |
| run: | | |
| set -euo pipefail | |
| mkdir -p /tmp/simw-top/build && cd /tmp/simw-top/build | |
| cmake .. -DCMAKE_BUILD_TYPE=Release -DCMAKE_C_FLAGS="-fPIC" \ | |
| -DPTMW_Applet=SE05X_C -DPTMW_SE05X_Auth=None -DPTMW_SMCOM=T1oI2C \ | |
| -DPTMW_HostCrypto=WOLFSSL -DPTMW_Host=LinuxLike >/dev/null | |
| cmake --build . -j"$(nproc)" >/dev/null | |
| cp /tmp/simw-top/fsl_sss_ftr.h /tmp/simw-top/build/ | |
| ls sss/libSSS_APIs.a sss/ex/src/libex_common.a \ | |
| hostlib/hostLib/se05x/libse05x.a hostlib/hostLib/liba7x_utils.a \ | |
| hostlib/hostLib/libCommon/log/libmwlog.a \ | |
| hostlib/hostLib/libCommon/libsmCom.a | |
| ln -sf /tmp/simw-top/build/sss/ex/src/libex_common.a \ | |
| /tmp/simw-top/build/sss/libex_common.a | |
| - name: Pass B, wolfSSL with --with-se050 | |
| run: | | |
| set -euo pipefail | |
| cd /tmp/wolfssl | |
| make clean >/dev/null | |
| ./configure --with-se050=/tmp/simw-top \ | |
| --enable-keygen --enable-cmac --enable-cryptocb --enable-ecc \ | |
| --enable-ed25519 --enable-curve25519 --enable-sha224 \ | |
| --enable-sha384 --enable-sha512 --disable-examples --enable-crypttests \ | |
| CFLAGS="-DWOLFSSL_SE050_INIT -DWOLFSSL_SE050_NO_TRNG -DSIZEOF_LONG_LONG=8 \ | |
| -DECC_USER_CURVES -DHAVE_ECC224 -DHAVE_ECC256 -DHAVE_ECC384" \ | |
| LDFLAGS="-L/tmp/simw-top/build" >/dev/null | |
| make -j"$(nproc)" >/dev/null | |
| sudo make install >/dev/null | |
| sudo ldconfig | |
| # SE050/README.md: the demos build from inside the SDK tree, at | |
| # simw-top/demos/wolfssl, tied in by an ADD_SUBDIRECTORY in demos/CMakeLists. | |
| - name: Build this repo's SE050 demos inside the SDK tree | |
| run: | | |
| set -euo pipefail | |
| cp -r SE050/wolfssl /tmp/simw-top/demos/wolfssl | |
| grep -q 'ADD_SUBDIRECTORY(wolfssl)' /tmp/simw-top/demos/CMakeLists.txt \ | |
| || echo 'ADD_SUBDIRECTORY(wolfssl)' >> /tmp/simw-top/demos/CMakeLists.txt | |
| cd /tmp/simw-top/build | |
| cmake .. >/dev/null | |
| cmake --build . -j"$(nproc)" 2>&1 | tail -20 | |
| find /tmp/simw-top/build -name 'wolfcrypt_test*' -type f | head -3 | |
| # Building proves the demos compile against the SDK; only running them | |
| # against the simulator proves wolfCrypt actually drives an SE050. | |
| - name: Run wolfcrypt_test against the simulator | |
| run: | | |
| set -euo pipefail | |
| /tmp/se050-sim-server > /tmp/sim.log 2>&1 & | |
| for _ in $(seq 1 50); do | |
| ss -tln | grep -qE ':(8050|1234) ' && break | |
| sleep 0.2 | |
| done | |
| echo "--- sim:"; head -5 /tmp/sim.log || true | |
| bin=$(find /tmp/simw-top/build -name 'wolfcrypt_test*' -type f -perm -u+x | head -1) | |
| [ -n "$bin" ] || { echo "FAIL: wolfcrypt_test not built"; exit 1; } | |
| "$bin" 2>&1 | tee /tmp/wct.log | tail -30 | |
| grep -qiE 'test passed|Test complete' /tmp/wct.log \ | |
| || { echo "FAIL: wolfcrypt_test did not report passing"; cat /tmp/sim.log; exit 1; } |